Hacked? Or did OC delete it's own DB tables?

webserver_issue

#1

Hi all, I'm trying to get to the bottom of an event on my server involving O.C. and was hoping someone here might be able to help. Here's the context.
I have oc running on a Debian machine, with apache as my webserver. The database is stored on /dev/sda. All of my own cloud data is stored on /dev/sdb which is an external USB drive. Everything had been working fine for many months.

A few days ago, /dev/sdb died. When I noticed my clients not updating I started looking around and the first thing I noticed was that all of the tables in my owncloud database were missing. Again the database was stored on /dev/sda which still functions fine & other web applications that I have running on that mysql server are also still running.

It looks to me like I got hacked. But my logs don't show anything that looks out of the ordinary. So my question, is it likely/possible that owncloud deleted it's own db files when /dev/sdb died??

Thanks in advance,
GPM


#2

This is very very unlikely. It might happen due to some bugs (especially in older oC versions) that some files got somehow removed from your system but then only table content (oc_filecache) would have been (partly) deleted, not the complete table or the database itself.


#3

Or perhaps some corrupt tables due to a reboot? Then some tables or dbs might not show up by default and you need to run some repair commands manually. If your system is not reliable and you are not sure if you have been hacked, it is probably better to start with a fresh setup of your system and restore ownCloud from backup.

Don't forget to update all service and review your configuration and security settings. The problem of old ownCloud setups with vulnerabilities has been in the media a couple of weeks ago.